peass-ng/PEASS-ng · error · SecurityException

Unable to resolve user name.

Error message

Unable to resolve user name.

What it means

CrackName uses the Active Directory DS Name Translation API (DsCrackNames) to convert a name to UPN form and throws SecurityException("Unable to resolve user name.") when the translation fails or returns a non-success status. It means the directory service could not map the supplied name to a directory object.

Source

Thrown at winPEAS/winPEASexe/winPEAS/TaskScheduler/TaskEditor/Native/NTDSAPI.cs:72

            /// <param name="domainControllerName">Name of the domain controller.</param>
            /// <param name="dnsDomainName">Name of the DNS domain.</param>
            /// <exception cref="System.ComponentModel.Win32Exception"></exception>
            public DomainService(string domainControllerName = null, string dnsDomainName = null)
            {
                Ntdsapi.DsBind(domainControllerName, dnsDomainName, out handle);
            }

            /// <summary>
            /// Converts a directory service object name from any format to the UPN. 
            /// </summary>
            /// <param name="name">The name to convert.</param>
            /// <returns>The corresponding UPN.</returns>
            /// <exception cref="System.Security.SecurityException">Unable to resolve user name.</exception>
            public string CrackName(string name)
            {
                var res = CrackNames(new string[] { name });
                if (res == null || res.Length == 0 || res[0].status != DS_NAME_ERROR.DS_NAME_NO_ERROR)
                    throw new SecurityException("Unable to resolve user name.");
                return res[0].pName;
            }

            /// <summary>
            /// Converts an array of directory service object names from one format to another. Name conversion enables client applications to map between the multiple names used to identify various directory service objects. 
            /// </summary>
            /// <param name="names">The names to convert.</param>
            /// <param name="flags">Values used to determine how the name syntax will be cracked.</param>
            /// <param name="formatOffered">Format of the input names.</param>
            /// <param name="formatDesired">Desired format for the output names.</param>
            /// <returns>An array of DS_NAME_RESULT_ITEM structures. Each element of this array represents a single converted name.</returns>
            public DS_NAME_RESULT_ITEM[] CrackNames(string[] names = null, DS_NAME_FLAGS flags = DS_NAME_FLAGS.DS_NAME_NO_FLAGS, DS_NAME_FORMAT formatOffered = DS_NAME_FORMAT.DS_UNKNOWN_NAME, DS_NAME_FORMAT formatDesired = DS_NAME_FORMAT.DS_USER_PRINCIPAL_NAME)
            {
                IntPtr pResult;
                uint err = Ntdsapi.DsCrackNames(handle, flags, formatOffered, formatDesired, (uint)(names?.Length ?? 0), names, out pResult);
                if (err != (uint)DS_NAME_ERROR.DS_NAME_NO_ERROR)
                    throw new System.ComponentModel.Win32Exception((int)err);
                try

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the machine is domain-joined and can reach a domain controller before cracking names
2. Check the input name format matches DS_NAME_FORMAT expectations (valid SAM/UPN/DN form)
3. Confirm the account exists in AD (e.g. via PrincipalContext lookup) and is not deleted
4. Catch SecurityException and fall back to using the raw name without UPN translation

Example fix

// before
string upn = ntdsApi.CrackName(accountName);
// after
try { upn = ntdsApi.CrackName(accountName); }
catch (SecurityException) { upn = accountName; /* keep raw name */ }

bool isDomainJoined = System.DirectoryServices.ActiveDirectory.Domain.GetComputerDomain() != null; // plus verify account exists via PrincipalContext before CrackName

try { upn = api.CrackName(name); } catch (SecurityException) { upn = name; }

When it happens

Trigger: Calling CrackName (used by the User account resolution path) with a name whose DS_NAME_ERROR status is not DS_NAME_NO_ERROR — non-existent account, malformed name, wrong formatOffered format, or a machine not joined to a domain.

Common situations: Resolving task principal user names on non-domain workstations; typos or stale SIDs/account names; querying a domain controller that cannot see the account (wrong domain/forest, deleted AD object).

Related errors

• Win32Exception

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/3a2cf94cd92219d9. Report an issue: GitHub.